[CQ-Contest] Fishy E-Mail from ARRL Contest Robot

[Zack Widup]

Someone's got a worm!

Most likely some contester out there put "dxphone at arrl.org" into his
address book. Some people have an automatic setting to put all addresses
they send e-mail to into their address books.  (My address book is
completely empty - I don't use it at all.) The "worm" picked that address
out of the address book as its fictitious "from" address.

I have no idea which one you got or what the "payload" is, but I'd also
recommend just deleting it.  It may be a brand-new worm.

73, Zack W9SZ

On Tue, 17 Jun 2003, Nat Heatwole wrote:

> Fellow contesters,
> Today I received an e-mail from the name "ARRL Contest robot" that was
> titled "UNABLE TO PROCESS LOG SUBMISSION." The text of the e-mail went
> as follows:
> 
> "(This is an automatic reply.)
> 
> Your message to dxphone at arrl.org could not be processed because it
> did not contain a callsign in the email Subject: header.  Please
> resubmit your log to dxphone at arrl.org with an email Subject: header
> that looks like this"
> 
> The e-mail had an attachment that was titled "LUETUT.XLS.pif" that was
> 72.3 KB large. I found this e-mail quite odd as I did not submit a log
> for the past ARRL DX Phone nor did I make any contacts in the contest on
> either mode. I hit the reply button to determine who the message really
> came from and Outlook Express listed the sender as
> unreplyable at alum.mit.edu. I would be willing to bet that the attachment
> that came with this e-mail is a victor india radio uniform sugar (I
> don't know if CQ-Contest will automatically bounce messages that have
> that work in them, hence when I am spelling it out) or something equally
> mischivious. Norton, however, did not raise a complaint regarding the
> message.
> 
> The e-mail message was also sent to many other parties including many
> contesters currently subscribed to this list (WN6K, WM5R, K1TTT, NQ4I,
> KR7X, K4OJ, WD4AHZ, KR6X, W7WHY, WW3S, among others).